I love Signal, and I have persuaded people to use it a lot. That said, it is definitely not the gold standard for privacy. It's a good-enough compromise between actual unbreakable encryption and trivial for anyone to use. It's always been valuable for that reason, and still is.

Don't worry about Molly - it uses a variation of the same code that Signal does, so they don't need "help" to get critical fixes that Signal receives. Use it if you like it!

The actual gold standard for privacy would be logging in through TOR and sending GPG-encrypted messages that way. And there's an app which does this, too - it's called Briar. (No phone number needed, either!) It's not as seamless to set up as Signal is, though.

Should note that their GitHub says:

We update Molly every two weeks to include the latest features and bug fixes from Signal. The exceptions are security issues, which are patched as soon as fixes become available.

I’m not sure on their track record, but if their claims are true, this could be a fine, secure client.

There's a FOSS fork of Signal which removes Google dependencies from the software.

Signal-FOSS

A fork of Signal for Android with proprietary Google binary blobs removed. Uses OpenStreetMap for maps and a websocket server connection, instead of Google Maps and Firebase Cloud Messaging.

https://github.com/tw-hx/Signal-Android

Molly, like Signal, uses Google’s proprietary code to support some features.

Right at the top of the Molly page.

For some reason I also was able to get most of my friends and family on Signal and just a year later I set up Matrix and now nobody wants no move anymore.

@baseless_discourse The gold standard has always been XMPP. It's the IETF Internet Standard for messaging, no walled gardens, ability to self-host, no phone numbers required and modern clients use the same end-to-end encryption protocol as Signal does.

XMPP or Matrix. I'm on Matrix only because I have my family there and I was there before I knew of XMPP and at this point I can't turn that boat.

Signal was/is (idk if they still are) into crypto, they don't let you run your own server or client, and they have a proprietary shim in place to combat spam (or so they say, it can't be audited because it's proprietary).

I was all in on Signal until the above.

“prosperity”

Do you mean proprietary?

What's your threat model?

Signal as a gold standard for encrypted messaging is based on many factors. Ease of use, UI/UX, protocol, platform support and so on.

Even though I'm a hard core FOSS person I'm also a realist. Sticking to a common platform is worth a lot. Bridging stuff with Matrix is cool but will not take off among most people.

Signal using Google blobs is a problem but let's face it, the UI will be presented on a Google branded Android phone or a iOS device anyhow. Sure you can use GrapheneOS and Molly or you can switch to another app altogether but heck you'll have no other to talk to then.

I use molly and it seems to be fine. You do make a fair point about a delay like that but i am not personally that concerned. If it were a month or more i would be apprehensive, but not a couple weeks.

I've been using it for close to a year because I can't link Signal to my desktop using QR code, Molly allows to provide the link directly and thus I use it. Everything works great.

For me Molly works but one can't use Signal betas (obviously) and backups are currupted for me for months.